Ransomware crews turn unpatched VPN access into network entry
Daily Cyber News: Ransomware crews turn unpatched VPN access into network entry
Ransomware groups are exploiting a patched authentication bypass in Palo Alto Networks products to establish unauthorized V P N sessions. Activity linked to Qilin, INC and other groups has continued for months after the vulnerability was disclosed. Because the access appears to come through an internal V P N, malicious sessions may initially look like legitimate remote work.
Key context: Organizations in education, finance, healthcare, IT, manufacturing and government have been exposed.
Additional detail: Organizations should patch every affected Palo Alto Networks system, review V P N sessions for unusual origins or behavior, and investigate related identity, virtualization, and data access.
For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.
Topics: cybersecurity news, cybersecurity, cyber risk, authentication bypass, credential theft, ransomware, vulnerability.
